Can I use https for local development?

Question

I'm attempting a slight variation of the Google+ web sign-in server side flow as described on the Google Developer's website.

Google's gapi code is giving this error message:

Uncaught SecurityError: Blocked a frame with origin "http://my-development-system.dev" from accessing a frame with origin "https://accounts.google.com". The frame requesting access has a protocol of "http", the frame being accessed has a protocol of "https". Protocols must match.

Am I right in saying that my local development system cannot be set up to use the https protocol?

Answer 1

This is not only to do with a differing protocol (HTTP on your site vs HTTPS on accounts.google.com), it is also because the domain does not match (and port for that matter), a restriction imposed by the Same Origin Policy.

This policy stops www.evil.com from loading a site such as www.bank.com inside a frameset (or popup window if framing is disabled) and then accessing the DOM. If the DOM could be accessed, this would be a massive security risk as any website could read your private data on another site.

It is possible to allow access by implementing a CORS policy and outputting server side headers to allow other specified domains to read content, however this would be on Google's side in your case. So unless https://accounts.google.com implements a CORS policy, you will not be able to make a client-side variation of the server side flow. Another barrier is that even if CORS was implemented it does not allow access to the DOM. However, you'd be able to retrieve content from another domain, protocol or port via AJAX calls. The target site would also have to output the Access-Control-Allow-Credentials: true header in order for authentication credentials (i.e. cookies in this case) to be sent with the request and the response read by your domain.

Can I use https for local development?

To answer your original question, the answer is yes. This can be a self-signed certificate for most purposes and it will not affect this particular error message in your browser (as you, as the browser user has chosen to accept and trust the certificate).